CVE-2025-61730
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-02-03
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | From 1.25.0 (inc) to 1.25.2 (inc) |
| golang | go | From 1.25.0 (inc) to 1.25.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs during the TLS 1.3 handshake when multiple messages are sent in records that cross encryption level boundaries, such as between the Client Hello and Encrypted Extensions messages. Due to this, subsequent messages may be processed before the encryption level properly changes, potentially allowing a network-local attacker to inject messages during the handshake and cause minor information disclosure.
How can this vulnerability impact me? :
The vulnerability can lead to minor information disclosure if a network-local attacker is able to inject messages during the TLS 1.3 handshake. This could potentially expose some sensitive handshake information to an attacker, impacting the confidentiality of the communication.